Is Sweezy Custom Progress Bar for Youtube™ safe?

Medium risk

Sweezy Custom Progress Bar is medium risk. Opening this extension's popup or its progress-bar controls POSTs to GA4 with a persistent install UUID that never rotates. Testing saw the same UUID across separate popup loads. The GA4 secret is base64-encoded in the source.

Sweezyv3.0.1Chrome Web Store
45Risk
Who publishes it

Sweezy - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Sweezy

Same store account

2 other listings published from this account, 130k+ users between them. 1 of them carries a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup telemetry ties a persistent UUID to every YouTube progress-bar interaction

Opening this extension's popup or its progress-bar controls POSTs to GA4 with a persistent install UUID that never rotates.

Testing saw the same UUID across separate popup loads.

The GA4 secret is base64-encoded in the source.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the extension popup or interact with a progress bar control.

Actions include: opening the popup, selecting a progress bar style, applying a custom color, or adding a new custom bar.

The extension did this

The popup sends a POST to Google Analytics 4 with a UUID that was created on install and never changes.

The event payload includes your persistent client_id, a session_id, the event name, and the page title.

Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-H20C76D7M5&api_secret=<redacted>

204 No Content, GA4 accepted the event; no body returned.

Headers
Content-Type
application/json
Body
{  "client_id": "fd8f8ee7-0c0a-445a-97f3-6263cee0a156",  "events": [    {      "name": "page_view",      "params": {        "session_id": "1749168000000",        "engagement_time_msec": 100,        "language": "en-US",        "page_location": "/popup.html",        "page_title": "YouTube Progress Bar Popup"      }    }  ]}
Fields sent in every GA4 Measurement Protocol request
  • Install-time UUID
    fd8f8ee7-0c0a-445a-97f3-6263cee0a156

    A unique identifier generated at install and stored permanently. It lets the developer recognize your browser across every popup session.

  • Session ID
    1749168000000

    A timestamp-based ID that groups events within a 12-hour window. Resets after 12 hours of inactivity.

  • Event name
    progress_bar_selected

    The specific interaction you performed, opening the popup, selecting a bar style, applying a custom color, or adding a new bar.

  • Page title
    YouTube Progress Bar Popup

    The title of the popup page at the time of the event, confirming which popup view was open.

Why you can't catch this in DevTools

The GA4 API credential is embedded in the extension source as a base64 string rather than fetched from a server. This makes it recoverable by anyone who inspects the extension files.

Decoded value
OzUB5btcQyO7OvimX0Sddw
The code that does this

GA4 telemetry function in popup.bundle.js (lines 20898-20955)

Readable version
// popup.bundle.js:20898 — GA4 API secret (base64-obfuscated)const rr = atob("T3pVQjVidGNReU83T3ZpbVgwU2Rkdw==");// Decodes to: OzUB5btcQyO7OvimX0Sddw// popup.bundle.js:20929–20955 — sendAnalyticsEvent(name, params)const or = ({ name: e, params: t }) =>  (async () => {    // Retrieve persistent UUID from chrome.storage.local key 'configuration.clientId'    const clientId = await (async () => (await er.get()).clientId)();    // Build or reuse session_id (12-hour TTL)    const sessionId = await (async () => {      const store = chrome.storage.session        ? new Ar(chrome.storage.session)        : new Ar(Yn);      let session = await store.getSessionData();      const now = Date.now();      if (session?.timestamp && (now - Number(session.timestamp)) / 60000 <= 43200) {        session.timestamp = now.toString();        await store.setSessionData(session);        return session.session_id;      }      session = { session_id: now.toString(), timestamp: now.toString() };      await store.setSessionData(session);      return session.session_id;    })();    const event = {      name: e,      params: {        session_id: sessionId,        engagement_time_msec: 100,        language: navigator.language,        page_location: location?.pathname,        ...t,      },    };    try {      await fetch(        `https://www.google-analytics.com/mp/collect?measurement_id=G-H20C76D7M5&api_secret=${rr}`,        {          method: "POST",          body: JSON.stringify({ client_id: clientId, events: [event] }),        }      );    } catch {}  })();// Call sites:// popup.bundle.js:37099 — fired on popup open: or({ name: 'page_view', params: { page_title: document.title } })// popup.bundle.js:36924 — fired on bar select:  or({ name: 'progress_bar_selected', params: { progress_bar_id, progress_bar_name } })// popup.bundle.js:34013 — fired on color pick:  or({ name: 'custom_color_used',      params: { progress_bar_id, progress_bar_name } })// popup.bundle.js:36966 — fired on bar added:   or({ name: 'customized_bar_added',   params: { progress_bar_id, progress_bar_name } })
Where telemetry data is sent
    • www.google-analytics.com

    Google Analytics 4 (Measurement Protocol). Receives the persistent client UUID, session ID, event name, and page title on every popup open and interaction.

What it can do

Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on youtube.com

    *://*.youtube.com/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026bnjlijllccbbjdeiflmakhkijbdddflj